Privacy Policy

Summary

Palimpseste is a 100% local application. Your documents, settings, and data stay on your computer. No personal data is collected, transmitted, or stored by NMA Conseil, except in the cases explicitly described below. Palimpseste Pseudo is a sister app: the corpus and table stay on your machine; NMA does not receive them (Pseudo section).

Data in the application

Documents and files

All your Markdown files, projects, backups, and snapshots are stored locally on your machine, in folders you choose. Palimpseste does not upload, sync, or transmit any of your files.

The flip side of this sovereignty: Palimpseste has no remote backup mechanism. Regular backup of your projects remains your responsibility (Time Machine, Windows File History, iCloud Drive, Dropbox, Syncthing, Git repository…). This absence is intentional: it is the price of full sovereignty over your data. Contractual details are in Article 7 bis of the Terms.

Application settings

Your preferences (theme, language, editor configuration, etc.) are stored locally in the application's configuration folder on your computer. They are never shared.

API keys (AI assistant)

If you use the built-in AI assistant, your API keys are stored in your operating system's secure keychain (Keychain on macOS). These keys never pass through our servers. AI requests are sent directly from your computer to the provider you chose (Anthropic, OpenAI, or a local model like Ollama/LM Studio).

License verification

When you activate a Pro license, the application sends a verification request to palimpseste.ai containing only your license key (no other data). This verification happens once, then the license is validated locally. The application works offline without limitation after activation.

Automatic updates

The version downloaded from our website periodically checks for updates via GitHub. This check does not transmit any personal data. It can be disabled. The Mac App Store version uses Apple's update mechanism and does not contact our servers.

Data on the website

Cookies and tracking

This website uses no tracking cookies, no analytics tools (no Google Analytics, no Facebook pixel). The only data stored in your browser is your language preference (via localStorage).

Download

To download the application, an email address is required. It is used solely to send the download link and is not shared with any third party. Rate limiting (5 requests per IP per hour) is applied to prevent abuse.

Payment

Payment is handled by Stripe. We only receive your email address for sending the license key. We do not store or process your banking information.

Third-party services

Palimpseste may communicate with the following third-party services, only at your initiative:

• Anthropic (api.anthropic.com) — if you configure the AI assistant with Claude
• OpenAI (api.openai.com) — if you configure the AI assistant with GPT
• Zotero (localhost:23119 or api.zotero.org) — if you use the bibliography integration
• Ollama / LM Studio (localhost) — if you use a local AI model

Each of these services has its own privacy policy. Palimpseste only sends the data necessary for the requested feature to function (text for AI, bibliographic queries for Zotero).

Children

Palimpseste does not knowingly collect personal data from children under 16.

Legal basis for processing

• Contract performance (GDPR Art. 6.1.b): email + license key + subscription status, necessary to deliver the Pro or Palimpseste Pseudo service and handle Stripe billing. A PAL-… key does not unlock Pseudo; a PSEUDO-… key does not unlock the editor.
• Legal obligation (GDPR Art. 6.1.c): retention of Stripe transactions for French accounting obligations (revenue ledger).
• Legitimate interest (GDPR Art. 6.1.f): anonymized audience statistics (track.php, daily-rotated IP+UA hash, no cookie) to steer product development.

Data retention

• Email + license key (active subscription): retained while your subscription is active, then 90 days after cancellation to handle Stripe disputes / chargebacks.
• Email after 90 days: pseudo-anonymized (replaced by a SHA-256 hash in the database) — the row remains for tax obligations but becomes unusable to re-contact you.
• Stripe accounting data (transactions, invoices): 10 years (French Commercial Code Art. L123-22).
• Anonymized audience logs: 12 months maximum (French CNIL recommendation).
• Project data (manuscripts, .md/.json files) and, for Pseudo, corpus + table: never collected by NMA — they stay on your machine. No server-side copy.

Palimpseste Pseudo — what NMA processes (the sale)

NMA Conseil is the controller only for the subscription: email, PSEUDO-… key, status, Stripe IDs, invoice. Basis: contract performance (Art. 6.1.b) and accounting duty (Art. 6.1.c, 10-year retention). This is not an impact assessment for your case file. The corpus, table and processed copies do not leave your machine; you are responsible for them, including backups. The application is an aid to pseudonymisation, in the GDPR sense: it does not replace a careful review. The software does not pick your legal basis. If you declare an assistant (this computer, the LAN, an SSH or WireGuard tunnel), case-file text goes to that assistant: NMA does not see it; the network is on you. Product risk note: palimpseste.ai/pseudo#risque.

Tables live on your machine as long as you keep them. The app does not purge them at expiry. The online erasure form (delete-my-data.php) covers Pro and Pseudo sale data: email, PAL-… / PSEUDO-… keys, Stripe IDs. It does not wipe files on your disk (Start over in the app). Other requests: contact@nma-conseil.fr (subject GDPR — Pseudo).

Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access (Art. 15): obtain a copy of your personal data we hold.
• Right of rectification (Art. 16): correct inaccurate data (notably your license email).
• Right to erasure (Art. 17): request deletion of your data. Note: Stripe accounting data (transactions) is retained for 10 years for tax obligations — full erasure is not possible before this delay.
• Right to portability (Art. 20): receive your data (email, license key, subscription status) in JSON. Your manuscripts being already local, they are natively portable.
• Right to object (Art. 21): object to processing based on legitimate interest (anonymized statistics).

How to exercise these rights

Self-service erasure (Art. 17): use our self-service form at palimpseste.ai/delete-my-data.php — you'll receive a confirmation email, and Pro and/or Palimpseste Pseudo sale data (email, keys, Stripe IDs) will be pseudo-anonymized as soon as you click the link (within 24 h). Local files (manuscripts, corpus, table) stay on your machine.

Other requests (access, rectification, portability, objection): email contact@nma-conseil.fr with subject GDPR — [requested right] and the email associated with your account. We respond within 30 days (GDPR Art. 12.3 legal delay). If we don't respond in that period or the response is unsatisfactory, you can lodge a complaint with the CNIL (French supervisory authority).

Data controller

NMA Conseil — Nicolas Mathieu
41 chemin de Versailles, 85350 Île d'Yeu, France
contact@nma-conseil.fr

Data Protection Officer (DPO): a sole proprietorship of this size is not required to appoint a DPO (GDPR Art. 37). The data controller (Nicolas Mathieu) directly fulfills this role. All GDPR requests should be addressed to contact@nma-conseil.fr.

Last updated: August 2026